Privacy Policy

What we collect

• Your account, if you create one. You can sign in with Google. We never see or store a password. From Google we receive your name, email address and profile picture, and we keep them so we can show who you are and attribute anything you contribute. While you're signed in we also store the IP address and browser your session was created from, which is how a session can be recognised and, if needed, revoked. The whole site works without signing in.
• Anonymous, cookieless usage analytics. We record which pages are viewed and a few key interactions so we can see what's useful and improve the site. It runs without cookies (nothing is stored on your device) and stays anonymous — even when you're signed in. We never connect your account to your analytics events. Visitors in the UK/EU/EEA & Switzerland are asked to opt in first via a banner; elsewhere this privacy-friendly analytics runs by default.
• Email — only when you give it. If you ask us to save your Surf Level shortlist, or to be notified about a coming-soon region, we keep the email you enter solely to send that — we never sell it or use it for anything else, and you can ask us to delete it anytime. The quiz itself works without an email.
• Your quiz answers, with nothing attached to them. When you finish the Surf Level quiz we keep the answers you picked, the level they produced, and the day it happened — so we can check the quiz is giving people the right level, which is something we currently have no way of knowing. We do not store your name, your email, your IP address, or any link to your account — not even if you're signed in. And we keep the day, never the time, on purpose: a precise timestamp could be matched against other records to work out which visit was yours, and a date can't. Visitors in the UK/EU/EEA & Switzerland: this only happens if you accepted the banner.
• Outbound-link clicks. When you click a link to a camp's own website, we record that the click happened (to understand which listings are useful). We do not attach your identity to it.
• Feedback & corrections. If you send feedback or report incorrect info, we keep your message. Providing an email is optional, and we don't store it alongside the report content.
• Camp claim requests. If you tell us you run one of the camps we list, we keep what you send — your name, your email, your role, and any note — so we can get back to you about it. That's the whole purpose; we don't use it for anything else.

We do not collect payment details (bookings happen on the camp's own site), and we don't ask for more than the above. There is no advertising on this site, no ad or attribution tracking, and we never share data with data brokers.

Analytics & cookies

We use PostHog (EU region) for privacy-conscious product analytics — pageviews and a few key interaction events. It's configured to be cookieless and anonymous: it sets no tracking cookies or local storage, doesn't profile you, and doesn't record your screen. PostHog is our data processor under a data-processing agreement, and data is processed in the EU.

Your region decides how it starts. If you're in the UK, EU/EEA, or Switzerland, we ask you to opt in via a banner first (decline and nothing is collected). Everywhere else, this privacy-friendly analytics runs by default. Your browser's Global Privacy Control / Do-Not-Track signal is honoured wherever you are.

You decide how it continues. Wherever you are, and whatever you chose before, you can turn analytics off — or back on — with the control below. It takes effect immediately, on the page you're standing on: no reload, no email, nothing to wait for. Turning it off is exactly one click, the same as turning it on. Either way, the whole site works.

The cookies we set. By default, just two small functional ones: a flag recording whether the consent banner applies in your region, and — once you answer it — your banner choice. Neither holds personal information, and neither is used for advertising.

If you sign in, we also set a session cookie so you stay signed in between pages. It is read only by our server, sent only over HTTPS, and expires after 7 days. Signing out clears it. A short-lived cookie (five minutes) is also used during the Google sign-in round-trip to protect against request forgery.

Who we share data with

We don't sell your data. We rely on a few service providers to run the site:

• Vercel — hosting and delivery of the website.
• Supabase — the database that stores account and site data. It runs in the United States.
• Google — only if you choose to sign in with Google. Google tells us your name, email and profile picture; we don't tell Google anything about what you do here. Google's own privacy policy covers their side.
• PostHog — the analytics described above.
• Cloudflare — routes email sent to our @surfcampscout.com addresses.
• Camp / booking partners — only when you click out to them. Once you leave our site, their own privacy policy applies.

Where your data lives. Our analytics is processed in the EU. Account data is stored in the United States, so if you're in the UK or EU/EEA, signing in means your name, email and session details are transferred there. You can use the entire site without signing in, in which case no account data exists to transfer.

Your choices

• You can ask us what data we hold about you, and ask us to delete it — email us and we'll do it by hand. We're being straight with you: there is no self-serve delete button yet. Building one is the next thing on our list, and until it exists, email is the way. (UK/EU/EEA visitors have access, deletion, and objection rights under GDPR/UK-GDPR; Canadians under PIPEDA; Californians under the CCPA/CPRA.)
• If you have an account, you can also sign out on any page — that ends the session immediately. Signing out doesn't delete your account; ask us if that's what you want.
• You can turn analytics off — or back on — at any time, using the control below. UK/EU/EEA & Swiss visitors also get the choice in a banner on their first visit. Your browser's Global Privacy Control / Do-Not-Track signal is honoured everywhere, and you can always email us.
• If you gave us your email, you can ask us to remove it at any time.

We do not sell or share your personal information (clicking a link out to a camp is not a data sale), and we don't use it for anything you didn't ask for. UK/EU visitors can also complain to their data-protection authority (in the UK, the ICO).

How long we keep things

• Your account — until you ask us to delete it.
• Sign-in sessions — a session stops working after 7 days, or as soon as you sign out.
• An email you gave us — until you ask us to remove it.
• Anonymous quiz answers — kept indefinitely. There is nothing in them that points to you, so there is nothing to delete on request; that is the trade we made to be able to keep them at all.
• A camp claim request — until it's resolved, then as a record that we handled it. Ask us and we'll delete it.
• Analytics — anonymous from the start, so there's nothing in it tied to you to keep or delete.

Children

Surf Camp Scout is intended for adults planning surf travel. It is not directed at children, and we don't knowingly collect data from them.

Changes

If we change this policy, we'll update the date at the top. Significant changes get called out clearly. On 26 July 2026 we added Google sign-in, and updated this policy the same week to describe the account data, the session cookie and the US database that came with it. On 1 September 2026 we moved the database from Neon to Supabase after our previous provider became unavailable. It is still a Postgres database in the United States, holding the same account and site data as before — only the company running it changed.

Contact

Questions about your data, or want it deleted? Email hello@surfcampscout.com and we'll help. You can also send a note via our feedback form.